Generally speaking, billing spikes come when you leave EC2 running, when EBS snapshots continues piling up, and also with NAT Gateway data transfer. S3 data transfer and CloudWatch logs can also grow without you noticing it. Background services and logs are common causes behind cost spike.